Authentication

Control Plane supports multiple authentication methods depending on how you access the platform.

Console UI

The Console supports single sign-on (SSO) for user authentication with the following providers:

Google

GitHub

Microsoft

SAML

After successful authentication, users’ access privileges are determined based on their assigned group membership or policy.

SAML Configuration

To enable SAML authentication for your organization, contact us on Slack or at support@controlplane.com.Values required from your authentication provider:

Entity ID
SSO URL
Certificate

Control Plane SAML configuration values:

Service Provider Entity ID: cpln.io
Assertion Consumer Service (ACS) / Callback URL: https://console.cpln.io/__/auth/handler

CLI

The CLI supports two authentication methods:

Interactive Login
Service Account Token

For interactive use, run the login command, which prints a URL and a confirmation code you use to complete SSO sign-in from any browser:

cpln login

This creates a default profile for your credentials. The browser does not have to be on the same machine as the CLI.

For CI/CD pipelines and automation, use a service account token:

# Create a profile using a service account token
cpln profile create PROFILE_NAME --org ORG_NAME --token TOKEN --default

The --default flag sets this profile as the default for future commands.You can also use the CPLN_TOKEN environment variable:

export CPLN_TOKEN=your-service-account-token

CLI Authentication Guide

Complete guide for CLI authentication, including service account token setup for CI/CD.

Terraform

Configure the provider with your organization and authentication credentials:

provider "cpln" {
  org   = "your-org-name"
  token = var.cpln_token  # Service account token
}

Or use environment variables:

export CPLN_ORG=your-org-name
export CPLN_TOKEN=your-service-account-token

Terraform Provider

Complete Terraform provider setup and configuration

Pulumi

Configure authentication using either Pulumi config or environment variables:

Pulumi Config
Environment Variables

pulumi config set cpln:org your-org-name
pulumi config set --secret cpln:token your-service-account-token

export CPLN_ORG=your-org-name
export CPLN_TOKEN=your-service-account-token

Pulumi Provider

Complete Pulumi provider setup and configuration

REST API

Authenticate API requests using a bearer token in the Authorization header:

curl --request GET \
  --url https://api.cpln.io/org/your-org/gvc \
  --header 'Authorization: Bearer YOUR_TOKEN'

Tokens can be obtained from:

Service account key: Generated when creating a service account
User access token: Run cpln profile token PROFILE_NAME

API Reference

Complete API documentation with interactive examples

Service Accounts

For programmatic access (CI/CD, automation, and IaC), create a service account and generate a key:

Create a service account

In the Console, navigate to Service Accounts and click New, or use the CLI:

cpln serviceaccount create --name my-service-account --org my-org

Generate a key

cpln serviceaccount add-key my-service-account --description my-key --org my-org

The key is shown only once. Save it immediately in a secure location.

Grant permissions

Add the service account to a group or create a policy that grants the necessary permissions.

Use the token

Use the generated key as your token in the CLI, Terraform, Pulumi, or API requests.

Create a Service Account

Step-by-step guide for creating and configuring service accounts

Documentation

Quickstart

Concepts

Core

Reference

Console UI

Google

GitHub

Microsoft

SAML

CLI

CLI Authentication Guide

Terraform

Terraform Provider

Pulumi

Pulumi Provider

REST API

API Reference

Service Accounts

Create a Service Account

​Console UI

Google

GitHub

Microsoft

SAML

​CLI

CLI Authentication Guide

​Terraform

Terraform Provider

​Pulumi

Pulumi Provider

​REST API

API Reference

​Service Accounts

Create a Service Account

Console UI

CLI

Terraform

Pulumi

REST API

Service Accounts